search

indieweb / indieauth

IndieAuth.net website code and IndieAuth Specification
52 stars 7 forks source link

Make IndieAuth object model similar to OIDC #110

Closed stokito closed 2 years ago

stokito commented 2 years ago

To be able to use the same DTOs as for OIDC it would be great to have fields with the same names:

me - (optional) The URL that the user entered

Looks similar to:

login_hint OPTIONAL. Hint to the Authorization Server about the login identifier the End-User might use to log in (if necessary). This hint can be used by an RP if it first asks the End-User for their e-mail address (or other identifier) and then wants to pass that value as a hint to the discovered authorization service. It is RECOMMENDED that the hint value match the value used for discovery. This value MAY also be a phone number in the format specified for the phone_number Claim. The use of this parameter is left to the OP's discretion.

But honestly it looks unsafe for me to ask and pass the param. A User must input it only on the AS side.

photo in IndieAuth looks similar to picture in OIDC.

https://openid.net/specs/openid-connect-core-1_0.html

aaronpk commented 2 years ago

login_hint, like me, is a suggestion from a client as to who the client expects to be logging in. It is untrusted data that the AS can choose to ignore for any reason.

The vocabulary that IndieAuth uses is based on h-card which is commonly used in projects that are using IndieAuth.

stokito commented 2 years ago

Thank you for the clarification. That's sad that OIDC didn't inherit vCard/h-Card names. The me param makes the spec slightly complicated